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Abstract. The objective of this paper is to define the safety life-cycle process for a payload beginning with the output of the 
Payload Safety Review Panel and continuing through the life of the payload on-orbit. It focuses on the processes 
and products of the operations safety implementation through the increment preparations and real-time operations 
processes. In addition, the paper addresses the role of the Payload Operations and Integration Center and the 
interfaces to the International Partner Payload Control Centers. 


INTRODUCTION 

The Payload Operations Integration Center (POIC), at the Marshall Space Flight Center (MSFC), is chartered by the 
ISS program to perform payload operations safety responsibilities specifically for NASA payloads and Station-wide 
in support of all International Partners’ (IP) payload safety requirements. Payload Operations Safety functions 
performed at POIC/MSFC in support of ISS is unique and separate from those safety functions performed at JSC. 
The value of POIC, as the center of payload operations safety, is that decades of payload experience on many 
manned space programs, combined with ISS payload-specific and safety training, yields an unparalleled base of 
knowledge and expertise from which to fulfill the safety functions described in this paper 


PRE-FLIGHT PAYLOAD OPERATIONS SAFETY 

The first step in the operational safety process is the assessment of a Safety Data Package (SDP) by the Johnson 
Space Center (JSC) Payload Safety Review Panel (PSRP). The SDP goes through a series of phased reviews. The 
number of reviews depends on several factors including payload complexity. The payload customer defines known 
or conceived operational hazards in hazard reports included in the SDP. An operational hazard control is defined as 
a method for preventing or controlling a known potential hazardous situation. During this safety data pack review, 
POIC Safety reviews the hazard reports, and ensures that all hazard controls identified are safe, effective, and 
feasible. At the conclusion of each safety review, the hazard reports are signed (by both the payload customer and 
PSRP chairman) and contain the approved operational hazard controls. These hazard reports are the basis for 
operational hazard control implementation. 

Operational hazard controls fall into one of three categories: Crew Procedures, Flight Rules or Training. The most 
common implementation of operational hazard controls is through crew procedures. The payload customer, who 
may be a NASA payload or an IP, develops the procedures and incorporates all procedural hazard controls. 

Flight Rule hazard controls are verified in a similar manner to procedural hazard controls. As with procedures, 

POIC Safety verifies that all Flight Rule hazard controls identified in the hazard reports are properly documented. 
POIC Safety develops the necessary Flight Rule consistent with the hazard control inputs given by the payload 
customer and the payload hazard reports, and those are submitted for integration with other POIC developed Flight 
Rules. 
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The responsibility for implementation of training hazard controls resides with the payload customer. Training as a 
stand-alone control for hazards is allowed only when a technique, skill, or perception needed to control hazards 
cannot be captured by procedures or flight rules. The payload customer provides to the crew the training identified 
as the controlling mechanism. POIC Safety monitors the training hazard controls and ensures that the training 
activities are scheduled. & 

To document all payload operations hazard controls in a single reference product, POIC Safety produces a Payload 
Hazard Control Matrix (PHCM). The PHCM is a compilation of all mission specific operational hazard controls, 
and also tracks the implementation and verification of the hazard controls. This is a control board-approved product 
for reference in real-time operations. The verification status of crew procedures and flight rules, including 
procedure references and rule numbers to control hazards, resides in the PHCM. Also, POIC Safety maintains a 
status of training and course completion dates to track training hazard controls. 

In addition to developing the PHCM, POIC Safety builds a Payload Hazard On-orbit Re-verification and 
Maintenance Log (PHORML), if required, following the safety reviews. Due to the longevity of ISS, it’s anticipated 
some payloads may remain on-orbit for extended periods of time. Payloads may require re-verification or 
maintenance activities to be performed in order to sustain hazard controls documented in the hazard reports. The 
PHORML is used to track on-orbit re-verifications or maintenance activities. It consists of information about the 
hazard control, which states when a reverification item needs to be verified on the ground and/or how often a 
maintenance item is to be performed on-orbit. The PHORML is only used to track on-orbit execution of the re- 
verification or maintenance activity, not development of the associated procedure. 

Once the PSRP process is completed and the POIC Safety has developed the PHCM and PHORML, there is a final 
phase of operational hazard control verification. This final process is called the Independent Safety Verification 
Review (ISVR). The purpose of an ISVR is to provide a final, independent, top-to-bottom assessment that all 
operations controls defined in the payload hazard reports are correctly reflected in the crew procedures. The ISVR, 
as a station-wide payload function, is also performed on all International Partner payloads, Lab Support Equipment 
(LSE) and integrated hazards. The ISVR begins as soon as the signed Phase III hazard reports and baseline crew 
procedures become available for a particular payload or integrated rack. During these inspections, implementing 
information, such as the procedure filename and step, is provided to the POIC Safety team for inclusion in the 
PHCMs. POIC Safety reviews and assesses the procedures and flight rules against the signed Hazard Reports, the 
Payload Hazard Control Matrix (PHCM) and the payload customer-provided operational hazard control references 
to ensure all operational controls are properly implemented. POIC Safety identifies any problems with the 
procedures and works with the payload customer to implement and verify correct controls in the crew procedures. 
Following all assessments on crew procedures and flight rules, a Certification of Flight Readiness (CoFR) statement 
is delivered to the Space Station Payloads Program Office endorsing all implementation of products used in real- 
time operations have been independently verified for safety compliance. 

Along with payload hazard reports, there is a report for integrated hazards, known as the Integrated Experiment 
Hazard Assessment Report (IEHA) generated by the Mission Operations Directorate (MOD) at the Johnson Space 
Center. For these assessments, integrated hazards are defined as those hazards associated with the interaction of one 
payload to another, or the interaction of a payload with the ISS systems or Government Furnished Equipment. 
POIC Safety is a Responsible Verification Organization for mission-based IEHA reports. The purpose of the IEHA 
is to document how MOD addresses integrated hazards for the payloads on-board the ISS for each stage and/or 
11 ight. The IEHA documents MOD organizational accountability for the integrated hazard controls. 

The mission-specific IEHAs are distributed in three stages: preliminary, draft, and final. Once the preliminary IEHA 
is distributed for review, POIC Safety conducts an assessment and provides input from an integrated payload hazard 
standpoint, identifying potential problem areas and/or new verification requirements. After POIC Safety’s 
preliminary submittal is delivered, an Open Items Log (OIL) will be provided by MOD to POIC Safety for tracking 
purposes. The OIL is used to track open items on the IEHA, which all open items are continually reviewed by POIC 
Safety for awareness of any change, until all are items are closed for the final IEHA delivery. During this time 
POIC Safety remains cognizant of any significant changes, either payload-related or ISS-related anomalies that 
could create on-board hazards for the ISS or payloads. Upon completion of the IEHA draft, POIC Safety submits a 
signed letter of concurrence stating all verification information has been reviewed and the verification requirements 
have been satisfied. A final edition of the IEHA is produced from the draft submittal, and delivered to POIC and 
posted onto the PSRP website. 



Another pre-flight duty of POIC Safety is to familiarize the crew and ground support personnel on all payload 
operational hazard controls. During the crew’s Payload Complement Training, POIC Safety presents the controls for 
the mission-specific payload hazards, including operational hazard controls, what the controls are, and the fire 
detection method (front breather payload vs. rear breather payload). A payload is considered a “front breather” if it 
exchanges air with the cabin for cooling purposes, however a payload is considered a “rear-breather “ if it exchanges 
air within the rack, utilizing the fans installed within a rack facility for cooling. 

POIC Safety trains and educates the POIC real-time flight controllers on all mission- specific payload operational 
hazards and controls. POIC Safety produces a detailed package of all the information about the hazards and hazard 
controls, listing the hazard report number, verification methods, any applicable flight rules, and a diagram or picture 
of the payload or rack pointing to the control mechanism. This training is a required class for flight controller 
certification for real-time operations. There is further training given to specific flight controllers on NSTS 18798-B 
“Interpretation Letters” document, the requirements of Hazard Reports, and the understanding of payload toxicity 
levels and components, payload fire detection and suppression, and payload maintenance items. 

A final safety task prior to real-time operations is the verification of the ISS Hazardous Material (HAZMAT) 
Database for payloads. HAZMAT is information about the chemical and biological materials flown in the STS and 
ISS pressurized volumes at any given time. HAZMAT contains: Payload hardware containing toxic samples, 
Toxicity Hazard Levels, IMS (bar code) location identifier, Toxic Sample Name, Toxic sample chemical/biological 
properties, concentration and volume. The HAZMAT tables are submitted to POIC Safety by approximately L-l 
month for review and processing from the Toxicology Office at JSC. POIC Safety verification includes, validating 
proper payload nomenclature and assuring the data is correct according to signed hazard reports. After such review, 
POIC Safety submits comments to the toxicology office and notes any discrepancies and/or approvals. Once the 
final version is given to POIC Safety from the toxicology office, it is distributed to appropriate POIC flight 
controllers for console operations. 

POIC Safety integrates all real-time products and necessary support information into a mission specific booklet, 
titled “ Safety Product Book”. The Payload Operations Director (POD) and Operations Controller (OC) both 
receive a Safety Product Book and a CD-ROM with all mission specific support material. 


REAL-TIME PAYLOAD OPERATIONS SAFETY 

There are several facets of safety during real-time operations. Overall real-time payload safety is the responsibility 
of the POIC cadre under the direction of the POD. The POIC flight control team works with both the Mission 
Control Center-Houston team and the ISS MER Safety team on any payload safety problems, responses, and 
impacts. In addition, the POIC flight control team is responsible for making sure all payload activities conducted, 
either by the crew or remotely from the ground, adhere to documented Flight Rules and other safety constraints. 

Within the POIC flight control team there is a designated position, the Operations Controller (OC), to monitor and 
maintain cognizance of hazard controls and potential safety situations on-board. The OC is specifically trained to be 
the payload operations response in an off-nominal situation involving SOF. The POD is the official interface to 
MCC-H and MER, and OC is the safety voice. POIC Safety personnel are the safety experts, and are called in as 
necessary, to support critical safety issues or questions. Throughout a mission, POIC Safety works closely with the 
OC and POD to ensure awareness about payloads that have operational hazards. For payload safety issues requiring 
safety assistance, the OC can request for POIC Safety to be called in with POD approval. POIC Safety uses 
resources such as, Safety Data Packs, signed Hazard Reports and the PHCMs to help with payload anomaly 
resolutions. Along with the signed hazard reports, the PHCM serves as a definite resource for ops hazard controls 
and can be accessed through the real-time websites. In the case of a safety payload anomaly, POIC Safety would 
notify and coordinate payload safety issues/dispositions with ISS Mission Evaluation Room (MER) Safety to ensure 
proper safety representation was coordinated for a payload Safety of Flight (SOF) issue. 
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POIC Safety reviews all Operations Change Request (OCR) for adherence to payload safety and to verify that 
hazard controls remain in effect. When crew procedures are released for review, via OCR, POIC Safety reviews 
crew procedures for any changes to an existing operational hazard control, implementation of a new hazard control, 
or change in the step number where the hazard control was to be found. If a change were made to an existing hazard 
control or implementation of a new hazard control, the PSRP would be notified through the Payload Safety Engineer 
(PSE) at JSC, and a meeting with the PSRP, PSE and POIC Safety would be coordinated. Once the PSRP 
approved/disapproved the ops hazard control change, POIC Safety communicates the message to POD, and 
documents the results in the OCR. After receiving approval from the Flight Director through POD, the POIC takes 
action to implement such resolution. 

During real-time operations, POIC Safety is responsible for keeping all safety products in the utmost condition with 
current information. Because of the changes that can occur within crew procedures, the PHCM often requires 
modifications. When it is appropriate for an update to occur, POIC Safety retrieves the master POHD and makes the 
changes. Once all changes are incorporated correctly in the PHCM, an OCR must be developed and submitted for 
cadre review and concurrence. This allows the process to implement the changes to the baseline product. After 
concurrence has been given, the new version of the PHCM is posted onto the realtime web sites and other proper 
locations. POIC Safety delivers a hardcopy to the POD and OC at that time, for revision of their Safety Product 
Book. 

Another real-time product that could require updating , is the Integrated Safety Product Matrices (ISPM) s. The 
ISPM includes payload information such as fire detection and suppression and toxicity levels involved with 
payloads. The OC and POD use the ISPM as a reference sheet during real-time operations. If an OCR effects the 
information in the ISPM, POIC Safety utilizes internal work instructions to update the product used by the real-time 
cadre. After dispositioning the OCR, POIC Safety retrieves the master ISPM lists and makes appropriate updates. 
Once the ISPMs have been updated with current data, POIC Safety delivers hardcopies and an updated CD ROM to 
the OC and POD console, and collects the old versions to prevent confusion. The turnaround time for these updates 
are immediate, for it is important for the POIC to always have a current and accurate reference of information, to 
guarantee safe payload operations onboard ISS. 


CONCLUSION 

This document was to convey the implementation of payload safety in an operational environment. It defines the 
process and responsibilities by which operational hazard controls are identified, implemented, and verified for all 
US partner payloads and Stationwide partner payloads on the ISS. POIC Safety continues to support and lead 
various efforts for pre-flight activities, as well as real-time operations, to ensure the safety of all payload operations 
onboard the ISS. 
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